Loading ToolBench
An MCP server that provides terminal command execution capabilities with security restrictions
The server exposes a single tool (run_command) with a dangerous WRITE risk profile and critical security gaps. The tool has a basic description and minimal input schema. The tool lacks essential output documentation, parameter type strictness, error guidance for recovery, and catastrophic security controls. Security attempts (dangerous_commands list) are bypassable and insufficient for production. The server also includes a resource (mcpreadme) that reads hardcoded paths on the user's filesystem, which is not a security-reviewed pattern.
Run a terminal command and return the output
Tool executes arbitrary shell commands with inadequate security controls. Dangerous command filtering (blacklist approach) is bypassable via command chaining (e.g., 'echo rm -rf /'), piping, aliasing, and case variations. Blacklist security is fundamentally broken for shell commands.
No permission checks or audit logging. The tool has no concept of user identity, authorization scopes, or who executed what command. An agent can execute destructive system commands without any access control.
Output schema is undocumented. The tool returns a dict with stdout, stderr, and returncode fields, but the description does not specify the output structure. LLMs cannot plan downstream operations without knowing what fields to expect.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 37 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 32 | - | v1 |
Parameter description is minimal (15 chars: 'The shell command to execute'). Lacks guidance on what commands are allowed, format constraints, timeout behavior, or examples of valid usage. Does not meet the 50-200 char baseline for LLM-optimized descriptions.
Error handling does not guide recovery. When a dangerous command is blocked, the error message names the dangerous command but does not offer alternatives or next steps. Timeout errors return unstructured strings instead of structured error objects with retryable classification.
Tool has inconsistent return types. Success returns a structured dict {stdout, stderr, returncode}. Timeouts and exceptions return plain strings ('Error: Command timed out...'), breaking LLM response parsing.
No timeout enforcement. asyncio.create_subprocess_shell is called without a timeout parameter. A runaway command (e.g., 'while true; do echo x; done') hangs the entire MCP server indefinitely, blocking all other requests.
Resource (mcpreadme) hardcodes a filesystem path (~/Desktop/ML/mcpreadme.md). This is not a generalizable or reviewable pattern; it couples the server to a single user's local filesystem layout and cannot be deployed in production or multi-tenant scenarios.